14

I am trying to implement a custom authorization attribute on my Web API controllers, but came across an unexpected behavior.

     <Authorize(Users:="myUser")>
     Public Function GetTodoItems() As IQueryable(Of TodoItem)

The above code works very well: It will allow "myUser" to retrieve the items, bot nobody else is allowed access. However, when I try the same approach with my custom authorization, the entire check is skipped, and any user can access the resource. Neither the AuthorizeCore nor the OnAuthorization overridden methods in my derived class are called.

     <MyAuth(Users:="myUser")>
     Public Function GetTodoItems() As IQueryable(Of TodoItem)

The derived class inherits from System.Web.Mvc.AuthorizeAttribute, and the project is deployed on IIS, with Windows Authentication & Impersonation enabled, and Anonymous Authentication disabled.

If I add the same custom authorization to an MVC Controller, then it works. But on the API Controllers, nothing. If the Authorize attribute wouldn't have worked either, it would have made more sense. Am I missing something? Is this an expected behavior, or a bug in the Beta?

Szilard Muzsi
  • 1,881
  • 2
  • 16
  • 20

2 Answers2

31

You should use System.Web.Http.AuthorizeAttribute from System.Web.Http.dll for Web API instead of System.Web.Mvc.AuthorizeAttribute.

That is, because namespace System.Web.Http.AuthorizeAttribute is derived from AuthorizationFilterAttribute. The filters are handled automatically by the Web API. In my own implementation I derived directly from AuthorizationFilterAttribute for handling of the basic HTTP authentication.

paulius_l
  • 4,983
  • 8
  • 36
  • 42
  • Thanks, changing the namespace worked! It still seems weird that using the `System.Web.Mvc.AuthorizeAttribute` worked for the Web API, whilst my class, which derived from that exact class, did not. – Szilard Muzsi Feb 28 '12 at 16:04
  • 1
    It seems like many types duplicate between MVC and Web API. Maybe they will be merged and we will have single sample of type in the release. So maybe either of the `AuthorizeAttibute` objects are being checked internally, just a guess. – paulius_l Feb 28 '12 at 16:08
4

I've built my own custom implementation for Basic Authorization:

http://remy.supertext.ch/2012/04/basic-http-authorization-for-web-api-in-mvc-4-beta/

Maybe this helps.

Remy
  • 12,555
  • 14
  • 64
  • 104